Loading story…
A misconfigured Active Directory Certificate Services (AD CS) template can let any Domain User enroll for a client-authentication certificate while supplying an arbitrary subject, allowing an attacker to obtain a certificate impersonating another user—including an administrator. The attacker can then authenticate to a domain controller, obtain a Kerberos ticket-granting ticket (TGT), and escalate privileges across the Active Directory domain. Windows certutil.exe supports administration and inspection of certificates, certificate authorities, stores, keys, and certificate revocation lists, and can help defenders review PKI configurations and artifacts.
GuidePoint Security identified a forensic visibility issue in the go-ese library: it decoded AD CS CA-database timestamps as OLE dates rather than Windows FILETIMEs, producing misleading 1899-12-30 dates. The merged fix distinguishes valid OLE dates from misinterpreted FILETIMEs based on the decoded float range, and Velociraptor 0.76.6 incorporates the corrected dependency, enabling VQL-based hunting for suspicious AD CS certificate requests. Organizations should audit certificate-template enrollment permissions, client-authentication usage, and subject-supply settings, then investigate anomalous certificate issuances associated with privileged accounts.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
A VQL artifact was developed to detect suspicious ADCS certificate-request activity associated with the described abuse technique. A pull request was submitted to the Velociraptor Artifact Exchange to make the hunting and analysis capability available to investigators.
Velociraptor updated its go.mod to use the corrected go-ese module, and version 0.76.6 includes the fix. Earlier Velociraptor releases return 1899-12-30T00:00:00Z for affected DateTime fields in ADCS CA databases.
A fix was merged into the official Velocidex go-ese repository that treats Flags=0 values as OLE dates only when their float64 value exceeds 1.0, otherwise decoding them as Windows FILETIMEs. The approach corrected ADCS parsing without breaking SRUDB.dat, which legitimately uses OLE dates.
Analysis of the ADCS CA database found that its DateTime fields were stored as Windows FILETIMEs despite being marked Flags=0, causing go-ese to decode them as OLE dates and return timestamps near 1899-12-30. Decoding the raw values as FILETIMEs matched timestamps reported by certutil.
Researchers described an ADCS certificate template that allowed all Domain Users to enroll, supported Client Authentication, and permitted enrollee-supplied subjects. An attacker could request a certificate for another user, authenticate to a domain controller as an administrator, obtain a Kerberos TGT, and act with that administrator's privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft’s November 2024 security updates patched 89 vulnerabilities, including 52 remote code execution flaws and several critical issues across Windows, .NET, Visual Studio, Exchange Server, and Active Directory Certificate Services (AD CS). Among the most notable fixes was **CVE-2024-49019**, an AD CS privilege escalation bug tied to insecure certificate template configurations, alongside actively exploited flaws **CVE-2024-43451** in Windows NT LAN Manager and **CVE-2024-49039** in Windows Task Scheduler. Other critical vulnerabilities addressed included **CVE-2024-43498** in .NET and Visual Studio, **CVE-2024-43625** in Windows VMSwitch, **CVE-2024-43639** in Windows Kerberos, and **CVE-2024-49056** affecting `airlift.microsoft.com`. Research published alongside the updates highlighted how AD CS abuse can extend beyond previously cataloged escalation chains, describing an **EKUwu** technique that leverages certificate Extended Key Usage handling to obtain unintended privileges in misconfigured environments. The findings reinforced that organizations running AD CS face elevated risk when certificate templates are loosely controlled, and they underscored Microsoft’s guidance to rapidly deploy the November patches and review certificate template settings to reduce exposure to privilege escalation and identity compromise.
Jul 24, 2026
Researchers and defenders warned that **Active Directory Certificate Services (AD CS)** can be abused to take over Windows domains through a combination of certificate misconfigurations and NTLM relay paths. SpecterOps documented multiple escalation techniques in its **Certified Pre-Owned** research, including vulnerable certificate templates, arbitrary Subject Alternative Name abuse, weak access controls, and relay attacks against AD CS web enrollment endpoints. The findings showed that attackers can obtain certificates usable for **PKINIT** or **Schannel** authentication, enabling privilege escalation, persistence that survives password resets, and in some cases creation of forged **"golden certificates"** if a CA private key is stolen. The risk became more urgent as the **PetitPotam** attack chain demonstrated how coercing NTLM authentication from a domain controller and relaying it to AD CS could lead to complete domain compromise. SANS highlighted the issue as a path to **domain admin**, while Microsoft published advisory **`ADV210003`** with mitigations rather than a security patch, recommending steps such as enabling **Extended Protection for Authentication**, requiring **HTTPS** on certificate enrollment endpoints, and reducing or disabling **NTLM** where possible. The combined disclosures showed that widely deployed AD CS environments could become a direct route to full Active Directory takeover if left misconfigured.
Jun 29, 2026
Researchers disclosed a working exploit and public proof-of-concept for **Certighost** (`CVE-2026-54121`), a flaw in Microsoft **Active Directory Certificate Services** that lets a low-privileged domain user obtain a certificate for a legitimate **Domain Controller** and authenticate as that machine. The issue stems from the AD CS certificate enrollment "chase" fallback, which trusted a requester-supplied directory target without properly verifying it was a real Domain Controller; by relaying the CA's authentication and standing up rogue SMB, LDAP, and LSA services, an attacker can have the CA sign a target DC's identity into a certificate.
Aug 4, 2026